Extracted

• • Target

    Bootstrapper.exe

  • Size

    889KB

  • MD5

    4a38f2fd264d3753024a560d0aaaa299

  • SHA1

    0e1bbf0e5fd66a4b731af686966f220d8b31e0e9

  • SHA256

    22164bae356ca295b6591f06832d663b48fe71ecf14cac212e446ce28bc27114

  • SHA512

    68208d1b48c5be93501426f37eb3582b30c5f4752d0addd614c8a51edeec4c9abebd44894163d30f0f437631e0b96657060ff81ad8a0e60dbe4b17d933352956

  • SSDEEP

    12288:SiJzQUyRS7vjzyGaL94l68NoS/S3iorPzSCH8MGSD2vKo7pnyzRyRB4c/YP8Mp1c:SiJsUG2KGaZ4OSa3hBH83S2pgzNbGp

  Score

  10^/10

  xwormpersistencerattrojandiscovery

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2